Wallet security

Users lose funds most directly at the point of signing: an approval with no limit, a permit signature presented as a login, a transaction that does something other than what the interface described. The same boundary now matters for software agents that sign on a user’s behalf.

In this area

Publications: 2
Reading time: 18 min

Primers explain a known class of issue with illustrative code. Analyses synthesise public incidents, standards and papers, each cited.

Publications

2 publications on wallet security

These publications explain how signature-based phishing works and what wallets and dApps can show to stop it, and how to give an autonomous agent spending authority that is scoped, capped and revocable.

Wallet Security31 October 202611 min read
Technical analysis
Agents that sign: securing autonomous on-chain execution
An agent that signs will one day be asked to sign the wrong transaction. A threat model for AI agents that transact, delegation from hot keys to ERC-4337 session keys and EIP-7702, and spending caps sized step by step.
Wallet Security25 August 20267 min read
Primer
Off-chain signatures, on-chain losses: the anatomy of approval phishing
Permit-style signatures let users authorise transfers without sending a transaction. The same property makes them a favoured tool for phishing. What wallets, dApps and users can check.

Wallet signature phishing
Case study

Apply it

Services and tools that use this research

Want this reasoning applied to your code?

Share the repository, the commit you plan to deploy and your timeline. The first output of any engagement is a written scope.

Request a Smart Contract Audit All research

Wallet security

Agents that sign: securing autonomous on-chain execution

Off-chain signatures, on-chain losses: the anatomy of approval phishing

Case studies and research assessments

Want this reasoning applied to your code?